mcp: attach to a remote browser over CDP#93
Closed
suchintan wants to merge 1 commit into
Closed
Conversation
Add RUSTWRIGHT_MCP_CDP_ENDPOINT / _CDP_HEADERS / _CDP_TIMEOUT_MS so the server can attach to an externally-owned browser over CDP instead of launching a local Chromium. In remote mode the local launch options are ignored, teardown detaches without terminating the remote browser, and a dead or unreachable remote fails loudly — it never silently falls back to a local browser. Endpoint and headers are never printed or logged. Docs cover the vendor-neutral usage with a hosted provider (x-api-key header) as an example; tests exercise a live remote (a second local browser) and a dead-endpoint failure. Co-Authored-By: Claude <noreply@anthropic.com>
suchintan
added a commit
that referenced
this pull request
Jul 21, 2026
…emas, full default tools) (#105) Builds the MCP server's default-toolset compatibility (stacked on the remote-CDP branch of #93 — that commit appears here until #93 merges): 1. **Foundations** — typed session state with an exactly-once per-page handler registrar (console/network/filechooser/dialog/download), a dedicated event lock, navigation epochs, bounded immutable event records; a safe file policy (`RUSTWRIGHT_MCP_OUTPUT_DIR` confinement, 0700/0600, byte caps, post-write integrity checks — screenshot paths outside the root now return a structured error, a documented breaking change); a strict ref-or-selector resolver (refs never fall through to CSS; selectors must match exactly one element); `serverInfo` now reports the package name/version; a clean-room contract-comparator harness. 2. **Canonical schemas** — the ten schema-divergent default tools advertise canonical camelCase parameters with snake_case accepted as hidden aliases (canonical wins on conflict); every advertised tool rejects unknown parameters (`additionalProperties: false`); a sectioned response envelope (Result/Page/Tabs/Snapshot); `--caps`/env acceptance (warn, never crash); `RUSTWRIGHT_MCP_TOOLSET=mirror|lean` profiles; `browser_evaluate` is registered by default with a `RUSTWRIGHT_MCP_ALLOW_EVAL=0` opt-out (SECURITY note in mcp/README.md). 3. **Docs** — copy-paste installs per client (Claude Code / Claude Desktop / any MCP client), a decision table, and a 60-second CLI quickstart. 4. **Default toolset completion** — resize, drag, fill_form, find, console_messages, network_requests/network_request (session-monotonic indices), file_upload; dialogs use pending-modal semantics across all tabs with a no-hang guarantee; automatic downloads are reported exactly once; envelope Console/Modal/Downloads sections; the contract fixture covers the full default set. ## Verification **120 tests, run twice, all green** — covering cross-tab modal handling, index stability across navigations, out-of-order download completion, path-escape and symlink-swap attempts, alias-conflict resolution, and exact fixture-vs-schema checks. The adversarial regression suites are retained under `mcp/tests/validation/`. ## Review updates Addressed review feedback: the file-chooser retry now binds to the originating input element's identity (no double-executing an unrelated click); symlink-escape cleanup removes only the in-root link, never the resolved external target (a sentinel test asserts the external file survives); the file policy tracks only paths it creates, so a user-configured output dir's pre-existing files are never chmodded or evicted; a context-level page handler covers `window.open` popups from birth; `RUSTWRIGHT_MCP_ALLOW_EVAL` parses strictly and fails loudly on unknown values; the contract comparator now pins the exact normalized `tools/list` (all 25 tools + full schemas + required sets) with an explicit additions allow-list; navigation eviction counters are bounded. ## Notes for reviewers - The screenshot path confinement and the eval default are deliberate, documented behavior changes (see mcp/README.md SECURITY + File outputs sections). - The contract fixture (`mcp/tests/contract/fixtures/default_toolset.json`) is clean-room: names/types/enums/defaults/required flags only. --------- Co-authored-by: suchintan <3853670+suchintan@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com>
Member
Author
|
Superseded by #105, which was stacked on this branch and carried these remote-CDP changes (RUSTWRIGHT_MCP_CDP_ENDPOINT/_HEADERS/_TIMEOUT_MS) into main as part of the default-toolset work. Closing as included. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fast-follow to the MCP server (#84): a vendor-neutral option to drive a remote browser over CDP instead of launching a local Chromium.
RUSTWRIGHT_MCP_CDP_ENDPOINT— attach to this CDP endpoint (remote mode). Local launch options (headless/channel/executable) are ignored.RUSTWRIGHT_MCP_CDP_HEADERS— optional JSON object of connect headers (e.g. an auth header); never printed or logged.RUSTWRIGHT_MCP_CDP_TIMEOUT_MS— connect timeout (default 60000).Fails loudly on a dead/unreachable remote — it never silently falls back to a local browser — and teardown detaches without terminating the remotely-owned browser.
Vendor-neutral: no SDK dependency. Docs use a hosted provider (Skyvern Browser Sessions, which exposes a CDP address +
x-api-keyheader) purely as an example. Tests exercise a live remote (a second local browser over--remote-debugging-port) and a dead-endpoint failure — 9 passing.